220-1102 Question 392
Single answer2.3 Compare and contrast wireless security protocols and authentication methods.A small accounting firm is replacing its wireless network. The office manager wants employees to sign in to Wi-Fi with their individual company usernames and passwords, and the owner wants to avoid using a single shared wireless password that would need to be changed whenever someone leaves the company. The firm does not have certificates deployed to employee devices, but it does have a RADIUS server integrated with Active Directory. Which wireless security configuration best meets these requirements?
- A
WPA2-Personal with AES and a complex pre-shared key
- B
WPA3-Personal using SAE
- C
WPA2-Enterprise using 802.1X with PEAP authentication against the RADIUS server
- D
Open Wi-Fi with a captive portal that asks for Active Directory credentials
Show answer and explanation
Correct answer: C
Explanation
The best answer is WPA2-Enterprise using 802.1X with PEAP and a RADIUS server. The scenario specifically requires individual logins, centralized authentication, and no device certificates. That combination strongly points to enterprise wireless rather than personal mode. WPA2-Personal and WPA3-Personal both rely on a shared passphrase, which does not satisfy the requirement to avoid a single shared wireless password. PEAP is commonly used in business environments where a RADIUS server is available and users authenticate with directory-based credentials, while EAP-TLS would typically require client certificates. In practice, CompTIA A+ expects candidates to distinguish personal mode from enterprise mode, understand that 802.1X with RADIUS enables per-user authentication, and recognize that captive portals are not a substitute for proper wireless security. Best-practice guidance from Wi-Fi Alliance and common enterprise deployment standards supports using enterprise authentication for internal corporate WLANs when centralized identity management is required.
- A. Incorrect.
This is incorrect because WPA2-Personal uses a single pre-shared key (PSK) for all users. Although AES is the correct encryption method for WPA2, a shared password does not meet the requirement for individual user authentication and creates an administrative burden when staff leave.
- B. Incorrect.
This is incorrect because WPA3-Personal with SAE improves security over traditional PSK-based networks and resists offline password guessing better than WPA2-Personal, but it is still a personal mode solution based on a shared passphrase, not per-user authentication through a centralized identity store.
- C. Correct.
This is correct because WPA2-Enterprise uses 802.1X for port-based network access control and supports individual user authentication through a RADIUS server. PEAP is a practical choice when client certificates are not deployed, because it commonly allows username/password authentication inside a protected TLS tunnel, often using existing Active Directory credentials through the RADIUS infrastructure.
- D. Incorrect.
This is incorrect because an open wireless network with a captive portal does not provide the same wireless-layer protection as WPA2/WPA3-Enterprise. Captive portals are common for guest access, but they do not replace proper Wi-Fi encryption and enterprise authentication for internal business users.